CVE-2024-9529

The Advanced Custom Fields plugin for WordPress contains a vulnerability in versions up to 6.3.8 that allows an authenticated administrator to inject malicious functions into custom post types, which can then be executed when users access those post types, potentially leading to unauthorized actions being performed. This is due to insufficient validation of certain plugin parameters, and while it can be exploited by attackers, it is considered a relatively low risk for most website owners.

Based on public CVE data (MITRE/NVD).